slarse
commented
3 years ago How would we go about doing that?
I feel like there are several things we can do before that. For example, we can have stronger branch protection rules, and require each PR to be approved before being merged (that's kind of a basic thing we really should have). Maintainers can't approve their own PRs, but that of course doesn't stop them from creating another account to create the PR to be approved.
To get around that we can require each PR be approved by two maintainers. That's of course extra overhead, but it's much safer. I think that beats any background check we can ever get going.
MartinWitt
raghav-deepsource
monperrus
Dear all,
Recently, there have been a number of software supply chain attacks. Basically, malicious persons push malicious code in open-source software: https://github.blog/2020-09-02-secure-your-software-supply-chain-and-protect-against-supply-chain-threats-github-blog/
Spoon is concerned by this problem, because if somebody pushes a backdoor in Spoon, she would have access to lots of source code, incl. proprietary code.
Consequently, integrators have the great responsibility to avoid backdoors. But what happens if integrators themselves are the attack vector?
To remediate to this problem, one solution is to introduce some kind of background check before giving the integrator role.
WDYT?